This directory contains a series of reverse engineering-related skill modules, each subdirectory is an independent module, containing SKILL.md describing its applicable scenarios, toolchain, and workflow.
CRITICAL: Routing execution contract (must be executed immediately)
After reading this file, replying only with "read/understood" is not allowed. You must execute in order:
NOW: run the platform-native router (Windowsscripts/master-route.ps1；Linux/macOS/Kaliscripts/master-route.sh), fromconfig/routing.jsondetermine PRIMARY; for difficult cases readrouting.mdthe three-axis appendix.NOW: platform-nativecase-initimplement the current analysis project'swork/<case>/scope.md；auth not granted prohibits ACT against the target. For local offline samples useoffline-samplepreset + explicit sample; Force must not bypass hard gates.ACT: immediately open PRIMARYSKILL.mdexecute ACTION REQUIRED.NEXT: tool paths only recognizetool-index.md; missing tools → platform-native bootstrap (manifest only).- Conclusions use Evidence→Finding→Path. report/journal is SHOULD, unless the user wants a deliverable.
Identity: see ops/IDENTITY.md(lightweight routing package + tool bootstrap + journal;is not a Z3r0-style platform).
If routing cannot hit, you must first go online to supplement the methodology and propose adding a new skill; stuffing into a mismatched module is prohibited.
Instruction semantic levels (RFC 2119)
MUST: must be executed; violation means task failure.MUST NOT: prohibited; violation means security breach.SHOULD: should be done in principle; if not done, the reason must be explained.MAY: optional action.
Current module
| Module | Directory | Applicable scenarios |
|---|---|---|
| General reverse engineering | reverse-engineering/ |
GDB / Frida / angr / Unicorn / Qiling / anti-analysis countermeasures / all-language platform reverse engineering / CTF pattern library |
| APK reverse engineering | apk-reverse/ |
Android APK unpacking, jadx decompilation, smali modification, Frida Hook, repackaging, signing, and installation |
| .NET / C# reverse engineering | dotnet-reverse/ |
Managed PE reverse engineering, dnSpyEx + de4dot deobfuscation (ConfuserEx/SmartAssembly/Babel), IL patch, Sharp* red team tool analysis, dnSpy MCP integration |
| IDA Pro reverse engineering | ida-reverse/ |
IDA Pro MCP HTTP server (72 tools): decompilation, disassembly, data flow tracing, cross-references |
| Front-end JS reverse engineering | js-reverse/ |
Browser-side signature location, encrypted parameter analysis, runtime sampling, Node environment reproduction; prefer using existing js-reverse_*, when a stronger browser/CDP/Hook surface is needed, integrate jshookmcp, but the premise is to first download/register and enable that MCP server |
| radare2 analysis | radare2/ |
CLI binary reconnaissance, disassembly, patch: r2 / rabin2 / rasm2 / radiff2 |
| CTF entry | ctf-sandbox/ |
Single PRIMARY; downstream still in sidecar ../CTF-Sandbox-Orchestrator/ |
| Technical documentation writing | docs-generator/ |
Automatically generate reverse engineering reports, penetration reports, CTF writeups, signature reverse engineering reports after task completion |
| Evidence graph review | case-review/ |
Validate scope, Evidence→Finding→Path traceability, workitems, timeline, and artifact hash |
| Browser and desktop automation | browser-automation/ |
Browser operations (Playwright) + Windows desktop application operations (OpenReverse UIA/CUA) + network observation |
| Cross-version symbol migration | binary-diff/ |
Migrating old symbols to new versions, deriving from missing PDBs, batch migrating function names after program updates |
| N-day patch diffing→exploitation | patch-diff-exploit/ |
Locating vulnerability points from vendor patches, writing PoCs, N-day weaponization (division of labor with binary-diff: this skill leans toward the offensive side) |
| RE→exploitation chain | pwn-chain/ |
From reverse engineering to a usable exploit: stack/heap/kernel pwn, pwntools, libc-database, stabilization from CTF to real remote targets |
| Firmware penetration chain | firmware-pentest/ |
OWASP FSTM nine phases: extraction→EMBA automation→Firmadyne/QEMU emulation→AFL++ fuzzing→real-device exploitation |
| EDR bypass reverse engineering | edr-bypass-re/ |
Red team scenarios: reverse engineering EDR hook tables/ETW/AMSI → direct syscalls / Hell's Gate / hardware breakpoints / call stack spoofing |
| Penetration testing toolchain | pentest-tools/ |
20+ penetration tools such as Nmap/Nuclei/SQLMap/FFUF/Hashcat/Pentest Swarm, exposed to AI via MCP |
| Diagram generation | diagram-generator/ |
Generating Mermaid/Graphviz/PlantUML diagrams from natural language (attack path diagrams, data flow diagrams, architecture diagrams, state machines) |
| Attack chain orchestration | attack-chain/ |
Overall commander for multi-stage attack path planning and execution; cross-stage tasks such as full penetration tests, HW exercises, and going from external network to domain controller start here |
| LLM/AI security testing | llm-security/ |
OWASP LLM + ASI Top 10: Prompt injection, tool abuse, memory poisoning, Agent hijacking, system prompt extraction,Agent compliance engineering |
| API security testing | api-security/ |
REST/GraphQL/WebSocket full protocol: BOLA/IDOR, JWT/OAuth attacks, 10-phase methodology |
| Supply chain security | supply-chain-security/ |
SBOM/SCA/CI-CD pipelines: dependency scanning, container security, build integrity, vulnerability reachability verification |
| Mobile reverse engineering | mobile-reverse/ |
Android + iOS: Frida/Objection dynamic instrumentation, SSL Pinning/Root/jailbreak detection bypass, OWASP MASTG |
| Malware analysis | malware-analysis/ |
Six-phase sample analysis, YARA/Sigma, anti-analysis detection, sandbox orchestration |
| DSL virtual machine reverse engineering | reverse-engineering/dsl-vm-reverse/ |
JS custom instruction set VM (IIFE + switch-case opcode); risk control/captcha engines, etc. |
| Operations contract ops | ops/ |
Scope / evidence chain / roles / timeline / identity / skill supply chain security |
| Community skill comparison | references/community-security-skills.md |
External security skill index and borrowing rules (blind installation prohibited) |
| Skill supply chain | ops/skill-supply-chain.md |
External skill/MCP installation gate (AST10 streamlined) |
| RE phase gate | reverse-engineering/references/re-agent-workflow.md |
triage→static→dynamic→synthesis |
| Authorized reconnaissance pipeline | pentest-tools/references/recon-pipeline.md |
scope gate + hit ≠ verification |
| Protocol reverse engineering | protocol-reverse/ |
Custom binary protocols / Protobuf / gRPC / PCAP frame layout |
| Ghidra reverse engineering | ghidra-reverse/ |
Open-source decompilation, headless, Ghidra MCP (main entry point when IDA is unavailable) |
| Binary Ninja reverse engineering | binary-ninja-reverse/ |
HLIL/MLIL/LLIL, Python API, and optional community MCP/localhost HTTP integration |
| Cloud / Container / K8s | cloud-k8s/ |
IMDS/IAM, container escape surface, Kubernetes RBAC |
| Windows / AD | windows-ad/ |
Kerberos, AD CS, BloodHound, relay and domain paths |
| Digital Forensics | digital-forensics/ |
Memory/disk timeline, PCAP traceback, IR preservation |
| Code Audit / SAST | code-audit/ |
Semgrep/CodeQL, white-box, dangerous APIs and authorization review |
| Threat Intelligence / OSINT | threat-intelligence/ |
Public-source IOC supplementation, campaign correlation, independent verification and intelligence handover |
| Threat Hunting | threat-hunting/ |
Hypothesis-driven hunting, Sigma detection engineering, blue team validation |
| OT / ICS Industrial Control | ot-ics/ |
Purdue zones, PLC/SCADA, passive-first assessment |
| Wi-Fi / Wireless | wifi-wireless/ |
Authorized wireless assessment, handshake/PMKID, lab rules |
| Browser Extension Reverse Engineering | browser-extension-reverse/ |
Chrome/Firefox extensions, MV3 worker, permission surface |
| macOS / Mach-O | macos-reverse/ |
Signing, ObjC/Swift, LaunchAgent, macOS samples |
| Thick Client | thick-client/ |
Desktop C/S, local storage, IPC, update channel |
| Go / Rust Reverse Engineering | go-rust-reverse/ |
Stripped Go/Rust, pclntab, panic strings |
| Hardware Debug Interfaces | hardware-security/ |
UART/JTAG/SWD, read-only extraction, firmware handover |
| Database Security | database-security/ |
MySQL/PG/MSSQL/Mongo/Redis exposure and configuration |
| Email Security | email-security/ |
Phishing breakdown, SPF/DKIM/DMARC, BEC |
| Federated Identity | identity-federation/ |
SAML/OIDC/OAuth SSO flows and misconfiguration |
| RF / SDR | radio-sdr/ |
Authorized RF research, receive-only by default |
Unified Entry
When encountering reverse engineering, CTF, packet capture, frontend signing, APK repackaging, or binary analysis tasks, enter in this order first:
- Platform-native router (Windows
scripts/master-route.ps1；Linux/macOS/Kaliscripts/master-route.sh）→ PRIMARY（config/routing.json） - Platform-native
case-init→scope.md - Open PRIMARY
SKILL.md - When in doubt, read
routing.md, and when a local path is needed, readtool-index.md
Work Approach
These modules can be combined as needed:
- Given a target → First look at the file type and choose the corresponding analysis tool
- Quick Wins → Check strings / rabin2 -z / ltrace for direct clues
- In-depth Analysis → If decompilation is needed→IDA; if dynamic hooking is needed→Frida; if symbolic execution is needed→angr
- If one path doesn't work, switch to another → If static analysis doesn't work, go dynamic; if the Java layer doesn't work, look at so; if page observation isn't enough, use breakpoints
Next-Step Menu Pattern
Only when genuine decision boundary(there are two or more materially different, evidence-supported branches, and the user's choice will change the next action) should the sub-skill MUST provide 3-6 numbered options. If the next step is uniquely determined by a gate / Evidence,MUST continue directly, and according to ops/timeline-workitem.md only record decision_delta + carry_forward_refs；MUST NOT to fabricate a menu, re-output unchanged route/scope/auth/context.
Format requirements:
- Each option is numbered (range 1-6)
- Each option describes a concrete executable action (not an abstract direction)
- Include at least one "export report/write writeup" option
- Contains at least one "continue in-depth analysis" or "try another method" option
- Includes a "stop/pause/ask another question" exit when necessary
Example:
## 建议下一步（选一个编号）
1. 对 sub_140001000 做深度反编译，还原算法
2. 用 Frida 动态 Hook 验证参数猜想
3. 导出当前已命名函数，生成符号迁移 YAML
4. 生成当前阶段的分析报告
5. 换 radare2 做轻量侦察对比
6. 暂停，我先确认前面的证据
The catalog is dynamically expanded
This catalog will keep growing. When a new subdirectory is discovered, read its SKILL.md to quickly understand its purpose.
When adding a new skill, follow the standard process in CONTRIBUTING.md , ensuring:
- The routing matrix can route correctly
- The bootstrap system can automatically fill in dependencies
- tool-index can reflect the new tool's status
Related resources
- This machine also has anything-analyzer(port 23816) MCP server, providing browser automation, HTTP capture, and AI analysis capabilities
tool-index.mdrecords whether this machine's reverse engineering tools are available, their actual paths, versions, and script references- Under the package root,
Readme.mdprovides general installation and integration instructions for Claude Code, Codex CLI, and other code AI clients
Bootstrap on demand
When a workflow finds a missing tool, do not error out directly. Uniformly call the platform-native bootstrap:
Windows：
powershell -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('工具名') -StartServices
Linux / macOS：
bash <skill-root>/scripts/bootstrap-reverse.sh 工具名 --start-services
Kali：
bash <package-root>/kali/scripts/bootstrap-reverse.sh 工具名 --start-services
Supported capabilities (subject to scripts/bootstrap-manifest.json ): jadx, apktool, jeb-pro, binaryninja, frida, frida-ps, idalib-mcp, reqable-mcp, jshookmcp, xquik-mcp, anything-analyzer, idapro, r2, rabin2, adb, agent-browser, ghidra-mcp, seclists, proxycat, burpsuite-mcp, nmap, pentestswarm, binwalk, yara, pwntools, bkcrack
JEB Pro is registered asmanual licensed installationcapability: bootstrap only outputs guidance and never downloads or circumvents commercial licenses. Reqable MCP only registers a fixed version of the official runtime, and still requires the user to install the Reqable desktop client themselves.
Tools not registered in the manifest (such as unblob/EMBA, etc.)
MUSTfollow manual installation steps in the skill documentation; it is forbidden to pretend they can be bootstrapped.
After bootstrap completes, it automatically refreshes tool-index。
Precedent Files
Before performing any reverse engineering/penetration operation, you MUST read in order:
| Read order | File | When to read |
|---|---|---|
| #1 | ops/scope-contract.md + case-init.ps1 |
Executable authorization gate.precedent-auth.md does not write granted |
| #2 | field-journal/precedent-reverse.md or precedent-pentest.md |
On demand — load only when the AI is hesitant |
#1 is prerequisite, #2 is lazy-loaded.
Automatic evolution
After completing each reverse engineering/penetration task, you must write back experience to the field-journal/ directory. See RULES.md 's "Hard Checklist After Task Completion".
- Template:
field-journal/_template.md - Index:
field-journal/_index.md - Precedents:
field-journal/precedent-auth.md→precedent-reverse.md→precedent-pentest.md - Before starting a new task, check the index and precedents first, and reuse existing experience
Task completion self-check (MUST pass before claiming completion)
- Did I complete the three-axis routing match (target type + user intent + toolchain)?
- Did I read the target skill's SKILL.md after successful routing?
- When routing did not hit, did I propose adding a new skill instead of forcing a match?
- Did I, based on
tool-index, use the real tool paths?